@paniniapi/forensics 0.0.0-stage → 0.1.0

package/dist/report.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type SignatureOptions } from './pdf/signature';
+import type { IntegrityReport } from './types';
+import type { ExtractOptions } from '@paniniapi/extract';
+export interface InspectOptions extends SignatureOptions {
+    /** Passed through to extractStatement (formatsDir, credentials, …). */
+    readonly extract?: ExtractOptions;
+}
+/**
+ * Full integrity inspection: container forensics (PDF only), signature
+ * validation, then extraction + arithmetic consistency. Never throws —
+ * malformed input produces warning signals, not exceptions.
+ */
+export declare function inspectStatement(input: Uint8Array | string, opts?: InspectOptions): Promise<IntegrityReport>;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,OAAO,KAAK,EAEV,eAAe,EAIhB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACtD,uEAAuE;IACvE,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;CACnC;AAoED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,UAAU,GAAG,MAAM,EAC1B,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgD1B"}

package/dist/report.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectStatement = inspectStatement;
+/**
+ * Document-integrity orchestrator — one call runs every applicable
+ * forensic layer and returns an explainable verdict.
+ */
+const extract_1 = require("@paniniapi/extract");
+const consistency_1 = require("./consistency");
+const content_1 = require("./pdf/content");
+const signature_1 = require("./pdf/signature");
+const structure_1 = require("./pdf/structure");
+function rollup(signals, sigs) {
+    if (signals.some((s) => s.severity === 'critical'))
+        return 'tamper_evidence';
+    if (signals.some((s) => s.severity === 'warning'))
+        return 'warnings';
+    if (sigs.some((s) => s.present))
+        return 'clean';
+    return signals.length === 0 ? 'inconclusive' : 'clean';
+}
+function signalizeSignatures(checks) {
+    const out = [];
+    for (const c of checks) {
+        if (c.digestValid === false) {
+            out.push({
+                ruleId: 'sig.digest_mismatch',
+                severity: 'critical',
+                message: 'signed-byte-range digest does not match — the signed content was altered',
+                evidence: `field ${c.fieldName ?? '?'} signer ${c.signer ?? '?'}`,
+            });
+        }
+        if (c.signatureValid === false) {
+            out.push({
+                ruleId: 'sig.invalid',
+                severity: 'critical',
+                message: 'embedded signature fails cryptographic verification',
+                evidence: `field ${c.fieldName ?? '?'} signer ${c.signer ?? '?'}`,
+            });
+        }
+        if (c.postSignBytes) {
+            out.push({
+                ruleId: 'sig.post_sign_append',
+                severity: 'warning',
+                message: 'bytes exist after the signed range — content was appended post-signature',
+                evidence: `field ${c.fieldName ?? '?'}`,
+            });
+        }
+        if (c.signatureValid === true && c.digestValid === true) {
+            out.push({
+                ruleId: 'sig.verified',
+                severity: 'info',
+                message: `signature by ${c.signer ?? 'unknown'} verifies — signed bytes are provably unaltered`,
+                evidence: c.chainTrusted === true ? 'chain trusted' : 'chain untrusted or not evaluated',
+            });
+        }
+        if (c.chainTrusted === false) {
+            out.push({
+                ruleId: 'sig.chain_untrusted',
+                severity: 'warning',
+                message: 'signature is cryptographically valid but the signer chain does not reach a trust anchor',
+                evidence: `signer ${c.signer ?? '?'}`,
+            });
+        }
+        for (const e of c.errors) {
+            out.push({
+                ruleId: 'sig.check_error',
+                severity: 'warning',
+                message: `signature check incomplete: ${e}`,
+                evidence: `field ${c.fieldName ?? '?'}`,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Full integrity inspection: container forensics (PDF only), signature
+ * validation, then extraction + arithmetic consistency. Never throws —
+ * malformed input produces warning signals, not exceptions.
+ */
+async function inspectStatement(input, opts = {}) {
+    const signals = [];
+    const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : input;
+    const format = (0, extract_1.sniffFormat)(bytes);
+    let signatures = [];
+    if (format === 'pdf') {
+        // extraction first so the statement period can inform structure checks
+        let statement = null;
+        try {
+            statement = await (0, extract_1.extractStatement)(bytes, opts.extract);
+        }
+        catch {
+            /* handled below */
+        }
+        signals.push(...(0, structure_1.inspectPdfStructure)(bytes, {
+            statementPeriodEnd: statement?.metadata['statementTo'] ?? null,
+        }), ...(0, content_1.inspectPdfContent)(bytes));
+        signatures = (0, signature_1.verifyPdfSignatures)(bytes, opts.trustStore === undefined ? {} : { trustStore: opts.trustStore });
+        return finalize(format, signals, signatures, statement);
+    }
+    if (format !== 'unknown') {
+        signals.push({
+            ruleId: 'container.no_integrity_layer',
+            severity: 'info',
+            message: `${format} carries no tamper-evident container — integrity verdict rests on arithmetic consistency only`,
+            evidence: `format=${format}`,
+        });
+    }
+    let statement = null;
+    try {
+        statement = await (0, extract_1.extractStatement)(bytes, opts.extract);
+    }
+    catch {
+        signals.push({
+            ruleId: 'container.unreadable',
+            severity: 'warning',
+            message: 'input could not be extracted for consistency checks',
+            evidence: `format=${format}`,
+        });
+    }
+    return finalize(format, signals, signatures, statement);
+}
+function finalize(format, signals, sigs, statement) {
+    let consistency = null;
+    const all = [...signals];
+    if (statement !== null && statement.transactions.length > 0) {
+        const c = (0, consistency_1.checkConsistency)(statement);
+        consistency = c.check;
+        all.push(...c.signals);
+    }
+    all.push(...signalizeSignatures(sigs));
+    const critical = all.filter((s) => s.severity === 'critical').length;
+    const warningCount = all.filter((s) => s.severity === 'warning').length;
+    return {
+        verdict: rollup(all, sigs),
+        format,
+        signals: all,
+        signatures: sigs,
+        consistency,
+        critical,
+        warningCount,
+    };
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAiGH,4CAmDC;AAlJD;;;GAGG;AAEH,gDAA4F;AAC5F,+CAAiD;AACjD,2CAAkD;AAClD,+CAA6E;AAC7E,+CAAsD;AAetD,SAAS,MAAM,CACb,OAAmC,EACnC,IAA+B;IAE/B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC7E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC;IACrE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;AACzD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiC;IAC5D,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC5B,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,0EAA0E;gBACnF,QAAQ,EAAE,SAAS,CAAC,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,aAAa;gBACrB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,qDAAqD;gBAC9D,QAAQ,EAAE,SAAS,CAAC,CAAC,SAAS,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,0EAA0E;gBACnF,QAAQ,EAAE,SAAS,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,gBAAgB,CAAC,CAAC,MAAM,IAAI,SAAS,iDAAiD;gBAC/F,QAAQ,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kCAAkC;aACzF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,qBAAqB;gBAC7B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,yFAAyF;gBAC3F,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,IAAI,GAAG,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,+BAA+B,CAAC,EAAE;gBAC3C,QAAQ,EAAE,SAAS,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,gBAAgB,CACpC,KAA0B,EAC1B,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,MAAM,MAAM,GAAG,IAAA,qBAAW,EAAC,KAAK,CAAC,CAAC;IAElC,IAAI,UAAU,GAA8B,EAAE,CAAC;IAC/C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,uEAAuE;QACvE,IAAI,SAAS,GAA8B,IAAI,CAAC;QAChD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAA,0BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,OAAO,CAAC,IAAI,CACV,GAAG,IAAA,+BAAmB,EAAC,KAAK,EAAE;YAC5B,kBAAkB,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI;SAC/D,CAAC,EACF,GAAG,IAAA,2BAAiB,EAAC,KAAK,CAAC,CAC5B,CAAC;QACF,UAAU,GAAG,IAAA,+BAAmB,EAC9B,KAAK,EACL,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CACrE,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,MAAM,+FAA+F;YACjH,QAAQ,EAAE,UAAU,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS,GAA8B,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,IAAA,0BAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,qDAAqD;YAC9D,QAAQ,EAAE,UAAU,MAAM,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CACf,MAAc,EACd,OAA0B,EAC1B,IAA+B,EAC/B,SAAoC;IAEpC,IAAI,WAAW,GAA4B,IAAI,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,GAAG,IAAA,8BAAgB,EAAC,SAAS,CAAC,CAAC;QACtC,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACxE,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;QAC1B,MAAM;QACN,OAAO,EAAE,GAAG;QACZ,UAAU,EAAE,IAAI;QAChB,WAAW;QACX,QAAQ;QACR,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** Severity of a forensic signal — verdict rolls up to the worst seen. */
+export type SignalSeverity = 'info' | 'warning' | 'critical';
+/** One explainable integrity finding. `ruleId` is stable for alerting. */
+export interface IntegritySignal {
+    readonly ruleId: string;
+    readonly severity: SignalSeverity;
+    readonly message: string;
+    /** Human-readable evidence: offsets, row indices, expected vs actual. */
+    readonly evidence: string;
+}
+/** Result of validating one embedded PDF signature. */
+export interface SignatureCheck {
+    /** True when a signature field was found and processed. */
+    readonly present: boolean;
+    readonly fieldName: string | null;
+    readonly signer: string | null;
+    readonly signTime: string | null;
+    /** Byte-range digest matched the CMS messageDigest attribute. */
+    readonly digestValid: boolean | null;
+    /** RSA/ECDSA signature verified over signedAttrs. */
+    readonly signatureValid: boolean | null;
+    /** Chain reached a caller-supplied trust anchor; null = no store. */
+    readonly chainTrusted: boolean | null;
+    /** Content exists after the signed ByteRange (post-sign append). */
+    readonly postSignBytes: boolean;
+    readonly errors: readonly string[];
+}
+/** Arithmetic-consistency findings over an extracted statement. */
+export interface ConsistencyCheck {
+    readonly balanceChainBreaks: number;
+    readonly openingMismatch: boolean | null;
+    readonly closingMismatch: boolean | null;
+    readonly sumMismatch: boolean | null;
+    readonly outOfPeriodRows: number;
+    readonly duplicateRows: number;
+}
+export type IntegrityVerdict = 'clean' | 'warnings' | 'tamper_evidence' | 'inconclusive';
+/** Top-level document integrity verdict — explainable, never a score. */
+export interface IntegrityReport {
+    readonly verdict: IntegrityVerdict;
+    readonly format: string;
+    readonly signals: readonly IntegritySignal[];
+    readonly signatures: readonly SignatureCheck[];
+    readonly consistency: ConsistencyCheck | null;
+    /** Counts by severity for quick gating. */
+    readonly critical: number;
+    readonly warningCount: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,QAAQ,CAAC,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAEzF,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Copyright 2026 Kapil — Project Panini Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG"}

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@paniniapi/forensics",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Deterministic document-integrity forensics for bank statements — PDF structural signals, CMS/PKCS#7 signature validation, and arithmetic consistency checks. Zero runtime dependencies, fully client-side.",
+  "license": "Apache-2.0",
+  "author": "Kapil",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "trust"
+  ],
+  "dependencies": {
+    "@paniniapi/extract": "0.2.3"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/peopleofproduct/Panini.git",
+    "directory": "packages/forensics"
+  },
+  "homepage": "https://github.com/peopleofproduct/Panini#readme",
+  "bugs": "https://github.com/peopleofproduct/Panini/issues",
+  "keywords": [
+    "fintech",
+    "india",
+    "bank-statement",
+    "pdf",
+    "forensics",
+    "tamper-detection",
+    "document-integrity",
+    "lending"
+  ]
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.